The boot firmware initialises memory, configures the platform and hands control to a boot loader. Because it executes first and stores itself in flash on the board, code planted there survives disk formatting and operating system reinstallation.
Why patches do not arrive
Firmware for a given board is assembled by the vendor from several suppliers' code. A fix upstream has to be integrated, validated and published per model, and many models stop receiving updates within a few years of release. Where updates exist, users often have to find them manually on a support page.
Practical steps
Check the manufacturer support page for your exact model once or twice a year, enable secure boot and a firmware password where available, and prefer vendors that ship firmware through the operating system's update channel. On Linux systems, the standard firmware update service can report and apply many updates automatically.